[observability] Observability Coverage Report - 2026-07-17

[github-actions[bot]]

Caution

agentic threat detected
Threat detection flagged this output in warn mode. Manual review is REQUIRED before any follow-up automation.

Details

The threat detection engine failed to produce results.

Review the workflow run logs for details.

Executive Summary

I analyzed a capped 5-run sample from the last 7 days. MCP telemetry coverage is present in every sampled MCP-enabled run via rpc-messages.jsonl fallback, so debugging data is available for the runs examined. I did not find any sampled firewall-enabled runs, so there is no access.log coverage to grade in this set.

Overall health is good: 4 runs are clean, 1 run has a telemetry quality warning because its RPC log mixes raw passthrough events with the canonical JSON-RPC stream. No critical observability gaps were detected in the sampled runs.

Key Alerts and Anomalies

No critical issues detected.

🔴 Critical Issues:

• None in the sampled set.

⚠️ Warnings:

• [§29540310803](https://github.com/github/gh-aw/actions/runs/29540310803) has rpc-messages.jsonl present, but the file includes mixed non-RPC passthrough events alongside the JSON-RPC stream, which weakens log uniformity.
• No firewall-enabled runs were present in the sampled set, so access.log coverage could not be evaluated.

Coverage Summary

Component	Runs Analyzed	Logs Present	Coverage	Status
AWF Firewall (access.log)	0	0	N/A	i️ N/A
MCP Gateway (gateway.jsonl or rpc-messages.jsonl)	5	5	100%	⚠️

📋 Detailed Run Analysis

Firewall-Enabled Runs

No firewall-enabled runs were present in the sampled set.

MCP-Enabled Runs

Workflow	Run ID	Telemetry Source	Entries	Servers	Tool Calls	Errors	Status
Smoke CI	§29543559048	rpc-messages.jsonl	6	2	0	0	✅
Smoke CI	§29538655595	rpc-messages.jsonl	6	2	0	0	✅
Issue Monster	§29543307324	rpc-messages.jsonl	14	1	6	0	✅
AI Moderator	§29542269537	rpc-messages.jsonl	8	2	1	0	✅
Avenger	§29540310803	rpc-messages.jsonl	28	1	1	0	⚠️

Missing MCP Telemetry (no gateway.jsonl or rpc-messages.jsonl)

None in the sampled set.

🔍 Telemetry Quality Analysis

Firewall Log Quality

• Total access.log entries analyzed: 0
• Blocked requests observed: 0
• Allowed requests observed: 0
• Sampled firewall coverage: not evaluable because no firewall-enabled runs were present

Gateway Log Quality

• Telemetry source: rpc-messages.jsonl fallback
• Total entries analyzed: 62
• MCP servers used: github, safeoutputs
• Total tool calls: 8
• Error rate: 0%
• Average response time: N/A for rpc-messages.jsonl without paired duration fields

Healthy Runs Summary

• 4 runs had complete, clean MCP telemetry
• 1 run had telemetry present but mixed-format entries that merit cleanup

Recommended Actions

1. Keep rpc-messages.jsonl export enabled for MCP runs until gateway.jsonl is consistently available.
2. Investigate the mixed-format stream in §29540310803 so passthrough events do not land in the canonical RPC log.
3. Ensure at least one firewall-enabled run lands in the daily sample so access.log coverage can be tracked instead of remaining N/A.

📊 Historical Trends

Not enough historical data was collected in this report to establish a trend line.

---

Report generated automatically by the Daily Observability Report workflow
Analysis window: Last 7 days | Runs analyzed: 5

References:

• §29543559048
• §29540310803
• §29543307324

Generated by 📊 Daily Observability Report for AWF Firewall and MCP Gateway · 12 AIC · ⊞ 14.5K · ◷

• expires on Jul 17, 2026, 4:13 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Daily Observability Report for AWF Firewall and MCP Gateway.

A newer discussion is available at Discussion #46315.